byt3bl33d3r / CrackMapExec

A swiss army knife for pentesting networks
BSD 2-Clause "Simplified" License
8.37k stars 1.64k forks source link

Error enumerating smb shares #447

Closed LorenzoDeBie closed 3 years ago

LorenzoDeBie commented 3 years ago

Describe the bug Every time I try to enumerate smb shares cme crashes. I tried manual installation and docker container.

To Reproduce & stacktrace execute this command:

crackmapexec smb --shares <ip>
SMB         <ip>      445    <computer-name>          [*] Windows 6.1 (name:<computer-name>) (domain:<domain>) (signing:False) (SMBv1:True)
Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/impacket/smbconnection.py", line 384, in connectTree
    return self._SMBConnection.connect_tree(share)
  File "/usr/lib/python3.9/site-packages/impacket/smb.py", line 2764, in tree_connect_andx
    if smb.isValidAnswer(SMB.SMB_COM_TREE_CONNECT_ANDX):
  File "/usr/lib/python3.9/site-packages/impacket/smb.py", line 718, in isValidAnswer
    raise SessionError("SMB Library Error", self['ErrorClass'] + (self['_reserved'] << 8), self['ErrorCode'], self['Flags2'] & SMB.FLAGS2_NT_STATUS, self)
impacket.smb.SessionError: SMB SessionError: class: ERRSRV, code: ERRbaduid(The UID is not known as a valid ID on this session.)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/cme/protocols/smb.py", line 533, in shares
    for share in self.conn.listShares():
  File "/usr/lib/python3.9/site-packages/impacket/smbconnection.py", line 407, in listShares
    dce.connect()
  File "/usr/lib/python3.9/site-packages/impacket/dcerpc/v5/rpcrt.py", line 800, in connect
    return self._transport.connect()
  File "/usr/lib/python3.9/site-packages/impacket/dcerpc/v5/transport.py", line 411, in connect
    self.__tid = self.__smb_connection.connectTree('IPC$')
  File "/usr/lib/python3.9/site-packages/impacket/smbconnection.py", line 386, in connectTree
    raise SessionError(e.get_error_code(), e.get_error_packet())
impacket.smbconnection.SessionError: SMB SessionError: 0x5b

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "src/gevent/greenlet.py", line 854, in gevent._gevent_cgreenlet.Greenlet.run
  File "/usr/lib/python3.9/site-packages/cme/protocols/smb.py", line 121, in __init__
    connection.__init__(self, args, db, host)
  File "/usr/lib/python3.9/site-packages/cme/connection.py", line 47, in __init__
    self.proto_flow()
  File "/usr/lib/python3.9/site-packages/cme/connection.py", line 86, in proto_flow
    self.call_cmd_args()
  File "/usr/lib/python3.9/site-packages/cme/connection.py", line 93, in call_cmd_args
    getattr(self, k)()
  File "/usr/lib/python3.9/site-packages/cme/protocols/smb.py", line 569, in shares
    error, desc = e.getErrorString()
  File "/usr/lib/python3.9/site-packages/impacket/smbconnection.py", line 1007, in getErrorString
    return nt_errors.ERROR_MESSAGES[self.error]
KeyError: 91
2021-01-10T12:36:13Z <Greenlet at 0x7faacc2d57b0: smb(Namespace(threads=100, timeout=None, jitter=None, , <protocol.database object at 0x7faacc264640>, '10.10.7.32')> failed with KeyError

Or using docker:

docker run --name cme --rm byt3bl33d3r/crackmapexec:latest smb --shares [] First time use detected [] Creating home directory structure [] Creating default workspace [] Initializing WINRM protocol database [] Initializing MSSQL protocol database [] Initializing SMB protocol database [] Initializing LDAP protocol database [] Initializing SSH protocol database [] Copying default configuration file [] Generating SSL certificate SMB 445 [*] Windows 6.1 (name:) (domain:) (signing:False) (SMBv1:True) Traceback (most recent call last): File "/usr/local/lib/python3.8/site-packages/impacket/smbconnection.py", line 384, in connectTree return self._SMBConnection.connect_tree(share) File "/usr/local/lib/python3.8/site-packages/impacket/smb.py", line 2764, in tree_connect_andx if smb.isValidAnswer(SMB.SMB_COM_TREE_CONNECT_ANDX): File "/usr/local/lib/python3.8/site-packages/impacket/smb.py", line 718, in isValidAnswer raise SessionError("SMB Library Error", self['ErrorClass'] + (self['_reserved'] << 8), self['ErrorCode'], self['Flags2'] & SMB.FLAGS2_NT_STATUS, self) impacket.smb.SessionError: SMB SessionError: class: ERRSRV, code: ERRbaduid(The UID is not known as a valid ID on this session.)

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/local/lib/python3.8/site-packages/cme/protocols/smb.py", line 533, in shares for share in self.conn.listShares(): File "/usr/local/lib/python3.8/site-packages/impacket/smbconnection.py", line 407, in listShares dce.connect() File "/usr/local/lib/python3.8/site-packages/impacket/dcerpc/v5/rpcrt.py", line 800, in connect return self._transport.connect() File "/usr/local/lib/python3.8/site-packages/impacket/dcerpc/v5/transport.py", line 411, in connect self.tid = self.smb_connection.connectTree('IPC$') File "/usr/local/lib/python3.8/site-packages/impacket/smbconnection.py", line 386, in connectTree raise SessionError(e.get_error_code(), e.get_error_packet()) impacket.smbconnection.SessionError: SMB SessionError: 0x5b

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "src/gevent/greenlet.py", line 854, in gevent._gevent_cgreenlet.Greenlet.run File "/usr/local/lib/python3.8/site-packages/cme/protocols/smb.py", line 121, in init connection.init(self, args, db, host) File "/usr/local/lib/python3.8/site-packages/cme/connection.py", line 47, in init self.proto_flow() File "/usr/local/lib/python3.8/site-packages/cme/connection.py", line 86, in proto_flow self.call_cmd_args() File "/usr/local/lib/python3.8/site-packages/cme/connection.py", line 93, in call_cmd_args getattr(self, k)() File "/usr/local/lib/python3.8/site-packages/cme/protocols/smb.py", line 569, in shares error, desc = e.getErrorString() File "/usr/local/lib/python3.8/site-packages/impacket/smbconnection.py", line 1007, in getErrorString return nt_errors.ERROR_MESSAGES[self.error] KeyError: 91 2021-01-10T12:37:37Z <Greenlet at 0x7f9982985590: smb(Namespace(aesKey=None, clear_obfscripts=False, con, <protocol.database object at 0x7f9982987ee0>, '10.10.7.32')> failed with KeyError


**Expected behavior**
List of smb shares being returned

**Crackmapexec info**
 - OS: Arch linux (5.10.5-arch1-1)
 - Version of CME: 5.1.1dev
 - Installed from [AUR](https://aur.archlinux.org/packages/crackmapexec/)

**Additional context**
SMBclient is able to enumerate the smb shares
mpgn commented 3 years ago

Hello,

Please follow the documentation

https://mpgn.gitbook.io/crackmapexec/smb-protocol/enumeration/enumerate-shares-and-access